Sniffing/capturing all traffic between Apache and Weblogic on Solaris

Question

We have an application where an embedded device talks to weblogic via Apache. Weblogic and Apache are on the same Solaris server, and we are using the weblogic module for Apache.

The communication works over http

It does not work over https, although the problem does not appear to be directly related to https (the SSL session is negotiated fine and some back and forth happens). It appears the device handles the communication differently when https is used.

We'd like to see the http/https requests and responses to debug this.

We can capture the data between device and server using (e.g.) wireshark, but that's encrypted so isn't a great help. Wireshark (or snoop) don't see the local traffic on the server between Apache and Weblogic. Note: on Linux we could do this - but not on Solaris.

We don't actually need the low level packet capture of Wireshark - capturing the headers and body of the http requests and responses would be sufficient.

Anyone know how do to this? Is there an apache mod that will log all the requests and responses that pass through, perhaps (A google didn't show anything obvious). Any other creative ways of doing this?

Answer 1

This might be of some help. http://httpd.apache.org/docs/2.2/mod/mod%5Flog%5Fforensic.html

Answer 2

I asked a similar question on ServerFault, and the best answer seemed to be to set up a TCP proxy on another machine, and force all communications to bounce through there.

So instead of:

Weblogic -> Apache

You would have:

Weblogic -> (across network) TCP Proxy -> (across network) -> Apache

Then you could do whatever tcpdump/wiresharking that you want. I used rinetd which worked well, but I know on Linux at least, the built-in inetd also has the ability to do proxying (and logging).

Update: If you can't do anything across the network, you could use the same concept and something like TcpProxy or something similar (possibly even your regular inetd) to do the proxying and logging. You could even use Netcat as a TCP Proxy. Someone else has also suggested using DTrace to snoop on loopback traffic, since that can hook right into the kernel.

Answer 3

You could use truss to capture the socket reads and writes performed by one of the processes.

Answer 4

My TCP capture program of choice is called balance.

 _           _
| |__   __ _| | __ _ _ __   ___ ___
| '_ \ / _` | |/ _` | '_ \ / __/ _ \
| |_) | (_| | | (_| | | | | (_|  __/
|_.__/ \__,_|_|\__,_|_| |_|\___\___|
  this is balance 3.42
  Copyright (c) 2000-2007,2008
  by Inlab Software GmbH, Gruenwald, Germany.
  All rights reserved.

It's design as a tcp load balancer utility, but using the -p packet dump flag it works pretty well to log all traffic in and out. It displays ASCII in ASCII and encodes everything as hex. It run fine as non-root when using ports >1024.